owasp-modsecurity/ModSecurity

View on GitHub

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

Stars: 9.8k
Forks: 1.8k
Open beginner issues: 0
Indexed issues: 265
Avg merge: 2h 46m
Merged PRs (30d): 1

Dominant language: C++
License: Apache-2.0
Last GitHub push: Jun 29, 2026
Latest indexed: Sep 20, 2026
Contributing guide: No contributing guide
Code of conduct: No code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

265 open issues indexed

Quotation Mark Formatting in ModSecurity Logs: Is the Use of Backticks and Single Quotes Correct? Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3369 · 4 comments · Opened May 2, 2025
Duplicate Server headers in Audit Log when using more_set_headers or more_clear_headers in Nginx Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 38/100

owasp-modsecurity/ModSecurity#3368 · 1 comment · Opened Apr 30, 2025
Remove possiblity to disable early-blocking processing Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 30/100

owasp-modsecurity/ModSecurity#3362 · 11 comments · Opened Apr 17, 2025
How to properly handle custom status after phase 3, 4 interception Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 38/100

owasp-modsecurity/ModSecurity#3357 · 4 comments · Opened Apr 7, 2025
Add support for parsing JSON in GBK format. Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3347 · 7 comments · Opened Mar 6, 2025
After building a custom docker image with the new version of nginx, the modsecurity page is turned on and it becomes messy! Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3333 · 12 comments · Opened Jan 23, 2025
Feature Request (v2): Add support for macro expansion for ipMatch operator Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3332 · 6 comments · Opened Jan 21, 2025
Feature Request(v3): adjust `requestBodyLimit` and `RequestBodyNoFilesLimit` via runtime rule Open

3.x libmodsec - missing features

owasp-modsecurity/ModSecurity#3330 · 2 comments · 1 assignee · Opened Jan 19, 2025
Help compiling ModSecurity with AFL Open

Difficulty 4/5 3-5 days Newbie friendliness 20/100

owasp-modsecurity/ModSecurity#3329 · 1 comment · Opened Jan 18, 2025
base64Decode behaviour against payload which contain + and / Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 30/100

owasp-modsecurity/ModSecurity#3327 · 14 comments · Opened Jan 10, 2025
Transformation `hexDecode` should not allow badly encoded inputs, or documentation should be updated Open

2.x 3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3325 · 3 comments · Opened Jan 9, 2025
ModSecurity 2.9.7 install on Windows is blocking access to some local URL Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3323 · 7 comments · Opened Jan 8, 2025
Post-use evaluation feedback Open

2.x

Difficulty 5/5 Over a week Newbie friendliness 15/100

owasp-modsecurity/ModSecurity#3320 · 2 comments · Opened Jan 6, 2025
how i can enable test utilitys at configure level with enable flag ? Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3318 · 2 comments · Opened Dec 30, 2024
I'm having trouble importing the modsecurity module into nginx. Open

2.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3317 · 7 comments · Opened Dec 23, 2024
Matched \"Operator `Eq' with parameter `0' against variable `REQUEST_HEADERS:Host' (Value: `0' ) Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 20/100

owasp-modsecurity/ModSecurity#3316 · 18 comments · Opened Dec 18, 2024
Cannot seem to compile for Windows 32-bit (x86) Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 30/100

owasp-modsecurity/ModSecurity#3313 · 17 comments · Opened Dec 3, 2024
Memory leak in vg_replace_malloc.c with large ruleset Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 42/100

owasp-modsecurity/ModSecurity#3311 · 1 comment · Opened Dec 3, 2024
Drop YAJL dependency Open

2.x 3.x

Difficulty 5/5 Over a week Newbie friendliness 30/100

owasp-modsecurity/ModSecurity#3308 · 36 comments · 6 reactions · Opened Nov 26, 2024
Enhancement: increase SecPcreMatchLimit for specific file Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3304 · 11 comments · Opened Nov 19, 2024
Memory Leak with nginx 1.26 Open

3.x

Difficulty 5/5 Over a week Newbie friendliness 20/100

owasp-modsecurity/ModSecurity#3303 · 1 comment · Opened Nov 14, 2024
Segmentation fault in ModSecurity 2.9 for Apache Open

2.x

owasp-modsecurity/ModSecurity#3300 · 49 comments · 1 assignee · Opened Nov 13, 2024
SecRuleUpdateActionById directive with a range Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3297 · 3 comments · Opened Nov 12, 2024
Operator @rx has different flags in two engines Open

3.x

owasp-modsecurity/ModSecurity#3295 · 6 comments · 1 assignee · Opened Nov 7, 2024
Unicode encoding (table) problem on engine level leading to CRS false positives (U+062F and U+D8AF resolving to slash) Open

2.x 3.x

Difficulty 4/5 3-5 days Newbie friendliness 30/100

owasp-modsecurity/ModSecurity#3294 · 7 comments · Opened Nov 4, 2024
Segment error occurs after calling msc_set_log_cb set callback function Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3292 · 1 comment · Opened Nov 1, 2024
using iptables marks or ipsets Open

2.x

Difficulty 5/5 Over a week Newbie friendliness 15/100

owasp-modsecurity/ModSecurity#3289 · 1 comment · Opened Oct 29, 2024
Custom Response Body Rule Not Blocking for Responses Larger Than 1KB Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3282 · 6 comments · Opened Oct 18, 2024
setvar never increments Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 30/100

owasp-modsecurity/ModSecurity#3278 · 1 comment · Opened Oct 15, 2024
Building ModSecurity Dynamic Module: Should I use ./configure --with-pcre2 for libmodsecurity and Nginx Connector? Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3277 · 3 comments · Opened Oct 15, 2024
Building from (Which) Source. Compilation recipe's instructions using outdate (SpiderLabs) URL's. On Purpose? Open

3.x

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3276 · 3 comments · Opened Oct 15, 2024
About CVE-2024-46292 Open

3.x

Difficulty 1/5 Under an hour Newbie friendliness 20/100

owasp-modsecurity/ModSecurity#3274 · 2 reactions · Opened Oct 12, 2024
SSL cert entry logs are not present in /var/logs/modsec_auddit.log file. Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3272 · 4 comments · Opened Oct 9, 2024
ModSecurity Audit Logs Showing Numeric Severity Instead of String Defined in Rules and Incorrect Severity Mapping Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3271 · 3 comments · Opened Oct 8, 2024
Inconsistent use of SecArgumentsLimit in Recommended Rules Open

2.x config

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

owasp-modsecurity/ModSecurity#3261 · 11 comments · Opened Sep 25, 2024
Escape double quotation mark character in non-regex operator Open

3.x bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3252 · 5 comments · Opened Sep 10, 2024
An error occurred when compiling and installing modsecurity Open

3.x

Difficulty 3/5 1-2 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3242 · 4 comments · Opened Aug 27, 2024
rx: regex error 'MATCH_LIMIT' for pattern Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3237 · 2 comments · Opened Aug 23, 2024
Review and document multi-threading support and limitations Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3215 · 4 comments · Opened Aug 7, 2024
libModSecurity3: all triggered rule IDs sometimes won't be logged with anomaly scoring Open

3.x bug

owasp-modsecurity/ModSecurity#3204 · 3 comments · 1 assignee · Opened Aug 2, 2024
Discussion about 'hostname' field in log Open

3.x

owasp-modsecurity/ModSecurity#3200 · 9 comments · 1 assignee · Opened Jul 29, 2024
Detect user agent and execute action Open

help wanted

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3184 · 3 comments · Opened Jul 17, 2024
[BUG] multiMatch lead to unexpected match Open

3.x bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3183 · 1 comment · Opened Jul 15, 2024
No error log if noauditlog is set Open

3.x bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3180 · 5 comments · Opened Jul 8, 2024
[modsecurity.conf-recommended] align processing on request & response for json Open

2.x config

Difficulty 1/5 Under an hour Newbie friendliness 50/100

owasp-modsecurity/ModSecurity#3175 · 4 comments · Opened Jun 24, 2024
Problem about proxy action Open

2.x Platform - Apache

Difficulty 4/5 3-5 days Newbie friendliness 35/100

owasp-modsecurity/ModSecurity#3170 · 7 comments · Opened Jun 12, 2024
Assistance Required with ModSecurity Rule Compatibility for OpenLiteSpeed Open

3.x help wanted

Difficulty 4/5 3-5 days Newbie friendliness 25/100

owasp-modsecurity/ModSecurity#3169 · 4 comments · Opened Jun 9, 2024
@pmFromFile problems Open

3.x

Difficulty 4/5 3-5 days Newbie friendliness 38/100

owasp-modsecurity/ModSecurity#3165 · 2 comments · Opened Jun 6, 2024
Best solution/workaround sanitise modsecurity v3 Open

3.x duplicate libmodsec - missing features

owasp-modsecurity/ModSecurity#3163 · 2 comments · 2 reactions · 1 assignee · Opened May 31, 2024
Apache: Short Lingering Close Open

2.x Platform - Apache

owasp-modsecurity/ModSecurity#3143 · 5 comments · 1 reaction · 1 assignee · Opened May 15, 2024

owasp-modsecurity/ModSecurity

Get new issues in your inbox